Behavioral task
behavioral1
Sample
MacroMethod.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
MacroMethod.exe
Resource
win10v2004-20231215-en
General
-
Target
MacroMethod.exe
-
Size
82KB
-
MD5
4bf4674da22656bf2f8a2fdf830be407
-
SHA1
d4bd356cae49965af27c91b273edf160c3c68cbe
-
SHA256
c594d37b47e5f83b47985b6a180180d41bfa589e2e2c8cb008e5e6172264f27a
-
SHA512
d30a1bca3ef351fecdac404c3282050913d043e7b8a23969c33141a279b40a63677c55bb7d0e0c4a2a698465b801281b4e83b6af05d3b45ba65a804dd0e2e432
-
SSDEEP
1536:22WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+FPIB2:2Zv5PDwbjNrmAE+VIB2
Malware Config
Extracted
discordrat
-
discord_token
MTE5MTIxNDM0OTcwMDg0MTU2Mw.GLHf3j.MJj3zOt4J0GXLenG9ec3SNwHbYK2FBbXB9eFZk
-
server_id
1185234913922912256
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MacroMethod.exe
Files
-
MacroMethod.exe.exe windows:4 windows x64 arch:x64
Password: MAMAGUEVOXD
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ